How ragulmanday/malware-detector works
Malware Detector is a Streamlit application that analyzes uploaded Windows executables and DLLs, alongside scripts for training and evaluating its classifier. In the runtime workflow, the app extracts EMBER features, normalizes them, runs a feedforward network, and presents a verdict; it supports both single-file and batch uploads. Training prepares labeled EMBER data, fits the scaler and network, and saves artifacts used by the app. Evaluation reuses training data preparation and reports classification metrics. Training-data wiring is based on the README; unsampled modules are not mapped in detail.
Main entry points: app.py Streamlit App · train.py Training Pipeline · evaluate.py Model Evaluation · model.py Neural Network
Components 9
Detection Runtime
- Streamlit App
app.py
PE Features
- EMBER Extractor
ember_local/features.py
Model Lifecycle
- Neural Network
src/model.py - Training Pipeline
src/train.py - Model Evaluation
src/evaluate.py
Saved Artifacts
- Fitted Scaler
model/scaler.pkl - Model Weights
model/malware_model.pth
Other components
- File Uploader
- EMBER Dataset
Connections 13
- File Uploader → Streamlit App: uploads files
README.md - Streamlit App → EMBER Extractor: extracts features
app.py - Streamlit App → Fitted Scaler: loads scaler
app.py - Streamlit App → Neural Network: runs inference
app.py - Streamlit App → Model Weights: loads weights
app.py - Streamlit App → File Uploader: shows verdict
app.py - EMBER Dataset → Training Pipeline: supplies data
README.md - Training Pipeline → Neural Network: trains network
src/train.py - Training Pipeline → Fitted Scaler: saves scaler
src/train.py - Training Pipeline → Model Weights: saves weights
src/train.py - Model Evaluation → Training Pipeline: reuses preparation
src/evaluate.py - Model Evaluation → Neural Network: evaluates network
src/evaluate.py - Model Evaluation → Model Weights: loads weights
src/evaluate.py